Unrated severityNVD Advisory· Published Dec 19, 2025· Updated Dec 19, 2025
Foxit pdfonline.foxit.com Stored Cross-Site Scripting in Page Templates Feature
CVE-2025-66502
Description
A stored cross-site scripting (XSS) vulnerability exists in pdfonline.foxit.com within the Page Templates feature. A crafted payload can be stored as the template name, which is later rendered into the DOM without proper sanitization. As a result, the injected script executes each time the affected PDF is loaded.
Affected products
2- Foxit Software Inc./pdfonline.foxit.comv5Range: before 2025‑12‑01
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.